Date: Sun, 10 Jul 2016 08:41:06 +0200
From: Summer of Pwnage <lists@...urify.nl>
To: fulldisclosure@...lists.org
Subject: [FD] Ultimate Member Local File Inclusion vulnerability
------------------------------------------------------------------------
Ultimate Member Local File Inclusion vulnerability
------------------------------------------------------------------------
Burak Kelebek, July 2016
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
It was discovered that Ultimate Member is vulnerable to PHP File
Inclusion. An authenticated attacker can exploit this issue to
compromise WordPress, for example by retrieving sensitive data from
local PHP files.
------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on the Ultimate Member WordPress
plugin version 1.3.64.
------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
There is a fix available in Pre-released version: pre-v1.3.65.10. After
the fix is applied user input is no more used when including local files
in WordPress.
------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/ultimate_member_local_file_inclusion_vulnerability.html
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/